<!DOCTYPE html>
<html>
<head>
  <meta charset="utf-8">
  
  <title>服务器安全之配置SSL访问实战 | Aurthur Article</title>
  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
  <meta name="description" content="在如今网络安全越来越被大众所重视，笔者虽然了解过https加密协议，但却还没有在自己服务器上部署过，趁着假期，在自己的机器上实践了一番，效果点击：Gitos Home
HTTPS 背景什么是HTTPS？HTTPS（全称：Hyper Text Transfer Protocol over Secure Socket Layer），是以安全为目标的HTTP通道，简单讲是HTTP的安全版。即HTTP下加">
<meta property="og:type" content="article">
<meta property="og:title" content="服务器安全之配置SSL访问实战">
<meta property="og:url" content="http://aurthur.gitos.cn/Aurthur-2015/Install-SSL-Certificate-In-Server.html">
<meta property="og:site_name" content="Aurthur Article">
<meta property="og:description" content="在如今网络安全越来越被大众所重视，笔者虽然了解过https加密协议，但却还没有在自己服务器上部署过，趁着假期，在自己的机器上实践了一番，效果点击：Gitos Home
HTTPS 背景什么是HTTPS？HTTPS（全称：Hyper Text Transfer Protocol over Secure Socket Layer），是以安全为目标的HTTP通道，简单讲是HTTP的安全版。即HTTP下加">
<meta property="og:updated_time" content="2017-01-07T12:46:31.000Z">
<meta name="twitter:card" content="summary">
<meta name="twitter:title" content="服务器安全之配置SSL访问实战">
<meta name="twitter:description" content="在如今网络安全越来越被大众所重视，笔者虽然了解过https加密协议，但却还没有在自己服务器上部署过，趁着假期，在自己的机器上实践了一番，效果点击：Gitos Home
HTTPS 背景什么是HTTPS？HTTPS（全称：Hyper Text Transfer Protocol over Secure Socket Layer），是以安全为目标的HTTP通道，简单讲是HTTP的安全版。即HTTP下加">
  
  
    <link rel="icon" href="/uploads/blog.ico">
  
  <link rel="stylesheet" href="/css/style.css">
</head>
<body>
  <div id="container">
    <div class="left-col">
    <div class="overlay"></div>
<div class="intrude-less">
	<header id="header" class="inner">
		<a href="/" class="profilepic">
			
			<img lazy-src="/uploads/blog.png" class="js-avatar">
			
		</a>

		<hgroup>
		  <h1 class="header-author"><a href="/">Aurthur</a></h1>
		</hgroup>

		
		<p class="header-subtitle">Aurthur Blog</p>
		

		
			<div class="switch-btn">
				<div class="icon">
					<div class="icon-ctn">
						<div class="icon-wrap icon-house" data-idx="0">
							<div class="birdhouse"></div>
							<div class="birdhouse_holes"></div>
						</div>
						<div class="icon-wrap icon-ribbon hide" data-idx="1">
							<div class="ribbon"></div>
						</div>
						
						
						<div class="icon-wrap icon-me hide" data-idx="3">
							<div class="user"></div>
							<div class="shoulder"></div>
						</div>
						
					</div>
					
				</div>
				<div class="tips-box hide">
					<div class="tips-arrow"></div>
					<ul class="tips-inner">
						<li>菜单</li>
						<li>标签</li>
						
						
						<li>关于我</li>
						
					</ul>
				</div>
			</div>
		

		<div class="switch-area">
			<div class="switch-wrap">
				<section class="switch-part switch-part1">
					<nav class="header-menu">
						<ul>
						
							<li><a href="/">主页</a></li>
				        
							<li><a href="/archives">所有文章</a></li>
				        
						</ul>
					</nav>
					<nav class="header-nav">
						<div class="social">
							
								<a class="github" target="_blank" href="https://github.com/aurthurxlc" title="github">github</a>
					        
								<a class="zhihu" target="_blank" href="https://www.zhihu.com/people/aurthur" title="zhihu">zhihu</a>
					        
								<a class="mail" target="_blank" href="/aurthurxlc@gmail.com" title="mail">mail</a>
					        
								<a class="google" target="_blank" href="https://plus.google.com/u/0/110645540964195673210" title="google">google</a>
					        
						</div>
					</nav>
				</section>
				
				
				<section class="switch-part switch-part2">
					<div class="widget tagcloud" id="js-tagcloud">
						<a href="/tags/ADB/" style="font-size: 10px;">ADB</a> <a href="/tags/API/" style="font-size: 10px;">API</a> <a href="/tags/Android/" style="font-size: 10px;">Android</a> <a href="/tags/Apache/" style="font-size: 12.5px;">Apache</a> <a href="/tags/CentOS/" style="font-size: 15px;">CentOS</a> <a href="/tags/Centos/" style="font-size: 12.5px;">Centos</a> <a href="/tags/Chkconfig/" style="font-size: 10px;">Chkconfig</a> <a href="/tags/Electron/" style="font-size: 10px;">Electron</a> <a href="/tags/FTP/" style="font-size: 10px;">FTP</a> <a href="/tags/FastCGI/" style="font-size: 10px;">FastCGI</a> <a href="/tags/Iterm/" style="font-size: 10px;">Iterm</a> <a href="/tags/Java/" style="font-size: 15px;">Java</a> <a href="/tags/Kernel/" style="font-size: 10px;">Kernel</a> <a href="/tags/Linux/" style="font-size: 17.5px;">Linux</a> <a href="/tags/Mac/" style="font-size: 12.5px;">Mac</a> <a href="/tags/Mirror/" style="font-size: 10px;">Mirror</a> <a href="/tags/Mysql/" style="font-size: 12.5px;">Mysql</a> <a href="/tags/Nginx/" style="font-size: 12.5px;">Nginx</a> <a href="/tags/PHP/" style="font-size: 20px;">PHP</a> <a href="/tags/RESTful/" style="font-size: 10px;">RESTful</a> <a href="/tags/Regular-Expression/" style="font-size: 10px;">Regular Expression</a> <a href="/tags/SSH/" style="font-size: 10px;">SSH</a> <a href="/tags/SSL/" style="font-size: 10px;">SSL</a> <a href="/tags/Sass/" style="font-size: 10px;">Sass</a> <a href="/tags/Server/" style="font-size: 10px;">Server</a> <a href="/tags/Terminal/" style="font-size: 10px;">Terminal</a> <a href="/tags/Ubuntu/" style="font-size: 10px;">Ubuntu</a> <a href="/tags/VPN/" style="font-size: 10px;">VPN</a> <a href="/tags/Vagrant/" style="font-size: 10px;">Vagrant</a> <a href="/tags/Volume/" style="font-size: 12.5px;">Volume</a> <a href="/tags/Web/" style="font-size: 12.5px;">Web</a> <a href="/tags/Windows/" style="font-size: 10px;">Windows</a> <a href="/tags/compile/" style="font-size: 10px;">compile</a> <a href="/tags/dd/" style="font-size: 10px;">dd</a> <a href="/tags/develop-tools/" style="font-size: 10px;">develop tools</a> <a href="/tags/gitlab/" style="font-size: 10px;">gitlab</a> <a href="/tags/go/" style="font-size: 12.5px;">go</a> <a href="/tags/gzip/" style="font-size: 10px;">gzip</a> <a href="/tags/hook/" style="font-size: 10px;">hook</a> <a href="/tags/java/" style="font-size: 10px;">java</a> <a href="/tags/mod-php/" style="font-size: 10px;">mod_php</a> <a href="/tags/ntp/" style="font-size: 10px;">ntp</a> <a href="/tags/supervisor/" style="font-size: 10px;">supervisor</a> <a href="/tags/web/" style="font-size: 10px;">web</a> <a href="/tags/zimg/" style="font-size: 12.5px;">zimg</a>
					</div>
				</section>
				
				
				

				
				
				<section class="switch-part switch-part3">
				
					<div id="js-aboutme">true</div>
				</section>
				
			</div>
		</div>
	</header>				
</div>
    </div>
    <div class="mid-col">
      <nav id="mobile-nav">
  	<div class="overlay">
  		<div class="slider-trigger"></div>
  		<h1 class="header-author js-mobile-header hide">Aurthur</h1>
  	</div>
	<div class="intrude-less">
		<header id="header" class="inner">
			<div class="profilepic">
				<img lazy-src="/uploads/blog.png" class="js-avatar">
			</div>
			<hgroup>
			  <h1 class="header-author">Aurthur</h1>
			</hgroup>
			
			<p class="header-subtitle">Aurthur Blog</p>
			
			<nav class="header-menu">
				<ul>
				
					<li><a href="/">主页</a></li>
		        
					<li><a href="/archives">所有文章</a></li>
		        
		        <div class="clearfix"></div>
				</ul>
			</nav>
			<nav class="header-nav">
				<div class="social">
					
						<a class="github" target="_blank" href="https://github.com/aurthurxlc" title="github">github</a>
			        
						<a class="zhihu" target="_blank" href="https://www.zhihu.com/people/aurthur" title="zhihu">zhihu</a>
			        
						<a class="mail" target="_blank" href="/aurthurxlc@gmail.com" title="mail">mail</a>
			        
						<a class="google" target="_blank" href="https://plus.google.com/u/0/110645540964195673210" title="google">google</a>
			        
				</div>
			</nav>
		</header>				
	</div>
</nav>
      <div class="body-wrap"><article id="post-Install-SSL-Certificate-In-Server" class="article article-type-post" itemscope itemprop="blogPost">
  
    <div class="article-meta">
      <a href="/Aurthur-2015/Install-SSL-Certificate-In-Server.html" class="article-date">
  	<time datetime="2017-01-07T12:46:31.000Z" itemprop="datePublished">2017-01-07</time>
</a>
    </div>
  
  <div class="article-inner">
    
      <input type="hidden" class="isFancy" />
    
    
      <header class="article-header">
        
  
    <h1 class="article-title" itemprop="name">
      服务器安全之配置SSL访问实战
    </h1>
  

      </header>
      
      <div class="article-info article-info-post">
        
	<div class="article-tag tagcloud">
		<ul class="article-tag-list"><li class="article-tag-list-item"><a class="article-tag-list-link" href="/tags/Apache/">Apache</a></li><li class="article-tag-list-item"><a class="article-tag-list-link" href="/tags/Linux/">Linux</a></li><li class="article-tag-list-item"><a class="article-tag-list-link" href="/tags/SSL/">SSL</a></li><li class="article-tag-list-item"><a class="article-tag-list-link" href="/tags/Server/">Server</a></li></ul>
	</div>

        
	<div class="article-category tagcloud">
	<a class="article-category-link" href="/categories/Technical/">Technical</a>
	</div>


        <div class="clearfix"></div>
      </div>
      
    
    <div class="article-entry" itemprop="articleBody">
      
        <p>在如今网络安全越来越被大众所重视，笔者虽然了解过https加密协议，但却还没有在自己服务器上部署过，趁着假期，在自己的机器上实践了一番，效果点击：<a href="https://gitos.cn" target="_blank" rel="external">Gitos Home</a></p>
<h1 id="HTTPS_背景">HTTPS 背景</h1><h2 id="什么是HTTPS？">什么是HTTPS？</h2><p>HTTPS（全称：Hyper Text Transfer Protocol over Secure Socket Layer），是以安全为目标的HTTP通道，简单讲是HTTP的安全版。即HTTP下加入SSL层，HTTPS的安全基础是SSL，因此加密的详细内容就需要SSL， 它是一个URI scheme（抽象标识符体系），句法类同http:体系，用于安全的HTTP数据传输。</p>
<p>https:URL表明它使用了HTTP，但HTTPS存在不同于HTTP的默认端口及一个加密/身份验证层（在HTTP与TCP之间）。这个系统的最初研发由网景公司(Netscape)进行，并内置于其浏览器Netscape Navigator中，提供了身份验证与加密通讯方法。现在它被广泛用于万维网上安全敏感的通讯，例如交易支付方面。</p>
<h2 id="HTTPS和HTTP的区别">HTTPS和HTTP的区别</h2><p>超文本传输协议HTTP协议被用于在Web浏览器和网站服务器之间传递信息。HTTP协议以明文方式发送内容，不提供任何方式的数据加密，如果攻击者截取了Web浏览器和网站服务器之间的传输报文，就可以直接读懂其中的信息，因此HTTP协议不适合传输一些敏感信息，比如信用卡号、密码等。</p>
<p>为了解决HTTP协议的这一缺陷，需要使用另一种协议：安全套接字层超文本传输协议HTTPS。为了数据传输的安全，HTTPS在HTTP的基础上加入了SSL协议，SSL依靠证书来验证服务器的身份，并为浏览器和服务器之间的通信加密。<br><a id="more"></a><br>HTTPS和HTTP的区别主要为以下四点：</p>
<ol>
<li>https协议需要到ca申请证书，一般免费证书很少，需要交费。</li>
<li>http是超文本传输协议，信息是明文传输，https 则是具有安全性的ssl加密传输协议。</li>
<li>http和https使用的是完全不同的连接方式，用的端口也不一样，前者是80，后者是443。</li>
<li>http的连接很简单，是无状态的；HTTPS协议是由SSL+HTTP协议构建的可进行加密传输、身份认证的网络协议，比http协议安全。</li>
</ol>
<h1 id="实践">实践</h1><p>今天实践的系统环境是Centos6.6 X64, web服务器为Apache</p>
<p>如果您的服务器是 Nginx 或者其他服务器，笔者暂时也没尝试过，但原理都差不多，只是具体到配置时需要分别处理</p>
<h2 id="获取SSL证书">获取SSL证书</h2><p>想要部署https加密访问，首要要做的就是获取SSL证书。如果是学习的话，获取免费的就可以了，这里推荐 <a href="https://buy.wosign.com/free/" target="_blank" rel="external"><em>沃通免费证书</em></a>。</p>
<p>如果是正规商业用途，还是用专业级别的证书吧，<a href="https://buy.wosign.com" target="_blank" rel="external">沃通</a>就有专业级别的证书 ，另外笔者还买过国外便宜的证书：<a href="https://www.namecheap.com/" target="_blank" rel="external">Namecheap</a></p>
<h3 id="服务器端SSL证书请求文件(CSR)生成">服务器端SSL证书请求文件(CSR)生成</h3><h4 id="检查服务器是否支持ssl模块">检查服务器是否支持ssl模块</h4><p>检查是否有mod_ssl.so文件，如无请重新编译Apache让其支持ssl</p>
<h4 id="生成私钥_Generate_the_private_key">生成私钥 Generate the private key</h4><p>请在服务器端使用以下命令来生成私钥<br><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">openssl genrsa -des3 -out www.mydomain.com.key 2048</span><br></pre></td></tr></table></figure></p>
<p>此命令会要求输入证书密码，请输入一个能记住的密码；命令中 www.mydomain.com 为您的域名即可；2048为私钥长度，这里是沃通要求，其他请按照情况选择1024或2048</p>
<h4 id="生成CSR文件_Generate_the_CSR">生成CSR文件 Generate the CSR</h4><p>请在服务器端使用以下命令来生成CSR<br><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">openssl req -new -key www.mydomain.com.key -out www.mydomain.com.csr</span><br></pre></td></tr></table></figure></p>
<p>此处需要填写很多信息</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">Country Name (2 letter code) [XX]:CN</span><br><span class="line">State or Province Name (full name) []:shanghai</span><br><span class="line">Locality Name (eg, city) [Default City]:shanghai</span><br><span class="line">Organization Name (eg, company) [Default Company Ltd]:gitos</span><br><span class="line">Organizational Unit Name (eg, section) []:bqteam-gitos</span><br><span class="line">Common Name (eg, your name or your server<span class="string">'s hostname) []:www.gitos.cn</span><br><span class="line">Email Address []:a@gitos.cn</span></span><br></pre></td></tr></table></figure>
<p>注意上面倒数第二行 Common Name ，此处一定要填写您开启https访问的域名，不能随便填写</p>
<h4 id="您也可以直接使用一个命令同时生成私钥和CSR文件：">您也可以直接使用一个命令同时生成私钥和CSR文件：</h4><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">openssl req -new -nodes -keyout www.mydomain.com.key -out www.mydomain.com.csr</span><br></pre></td></tr></table></figure>
<h3 id="用SSL证书请求文件(CSR)获取证书">用SSL证书请求文件(CSR)获取证书</h3><p>将www.mydomain.com.csr内的内容粘贴到证书发放的网站，获取到您的证书，下载后传到您的服务器，下面配置将用到它</p>
<h2 id="配置Apache服务器">配置Apache服务器</h2><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="tag">&lt;<span class="name">VirtualHost</span> *<span class="attr">:443</span>&gt;</span></span><br><span class="line"></span><br><span class="line">    DocumentRoot "/path"      //设置网页存放目录</span><br><span class="line"></span><br><span class="line">    ServerName www.gitos.cn:443                  //服务器的端口</span><br><span class="line"></span><br><span class="line">    DirectoryIndex index.html index.html.var  //首页名称</span><br><span class="line"></span><br><span class="line">    SSLEngine on</span><br><span class="line"></span><br><span class="line">    SSLCertificateFile /path/www.mydomain.com.crt    //证书</span><br><span class="line"></span><br><span class="line">    SSLCertificateKeyFile /path/tls/www.mydomain.com.key  //私钥</span><br><span class="line"></span><br><span class="line">    SSLCACertificateFile /path/1_root_bundle.crt</span><br><span class="line"></span><br><span class="line">    <span class="tag">&lt;<span class="name">Directory</span> "/<span class="attr">path</span>"&gt;</span></span><br><span class="line">        AllowOverride All</span><br><span class="line"></span><br><span class="line">        Order allow,deny</span><br><span class="line"></span><br><span class="line">        Allow from all</span><br><span class="line"></span><br><span class="line">    <span class="tag">&lt;/<span class="name">Directory</span>&gt;</span></span><br><span class="line"></span><br><span class="line"><span class="tag">&lt;/<span class="name">VirtualHost</span>&gt;</span></span><br></pre></td></tr></table></figure>
<p>配置完成后，重启Apache，访问<a href="https://www.gitos.cn" target="_blank" rel="external">https://www.gitos.cn</a>，发现配置已经成功。</p>
<h2 id="完善Apache服务器配置">完善Apache服务器配置</h2><p>到此，访问<a href="https://www.gitos.cn" target="_blank" rel="external">https://www.gitos.cn</a>已经没有任何问题，但是如果用户通过80端口访问，也就是通过http协议访问网站时，会出现一个大大地错误或者出现Apache默认页面，非常的不友好，毕竟浏览器默认访问端口为80端口</p>
<p>为了解决它，那么就要使用一些技巧啦。最常用的呢就是用端口重定向使所有80端口的访问转到443端口即可，有很多方法可以解决，比如nginx自带重定向功能，但是这里用的Apache，那么就给一个Apache的解决方案吧</p>
<p>使用Rewrite模块进行重定向，将下列语句添加在配置文件中或者程序的.htaccess中，如果没有安装这个模块请重新编译安装<br><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">RewriteEngine on    </span><br><span class="line">RewriteCond %&#123;SERVER_PORT&#125; !^443$  </span><br><span class="line">RewriteCond %&#123;REQUEST_URI&#125; !^/tz.php  </span><br><span class="line">RewriteRule (.*) https://%&#123;SERVER_NAME&#125;<span class="variable">$1</span> [R]</span><br></pre></td></tr></table></figure></p>
<p>至此结束啦，有问题欢迎指正</p>

      
    </div>
    
  </div>
  
    
<nav id="article-nav">
  
    <a href="/Aurthur-2015/Iterm2-config.html" id="article-nav-newer" class="article-nav-link-wrap">
      <strong class="article-nav-caption"><</strong>
      <div class="article-nav-title">
        
          Iterm2 配置
        
      </div>
    </a>
  
  
    <a href="/Aurthur-2015/Install-PHP-In-Centos.html" id="article-nav-older" class="article-nav-link-wrap">
      <div class="article-nav-title">在 CentOS 上搭建 PHP 服务器环境</div>
      <strong class="article-nav-caption">></strong>
    </a>
  
</nav>

  
</article>






</div>
      <footer id="footer">
  <div class="outer">
    <div id="footer-info">
    	<div class="footer-left">
    		&copy; 2017 Aurthur
    	</div>
      	<div class="footer-right">
      		<a href="http://hexo.io/" target="_blank">Hexo</a>  Theme <a href="https://github.com/litten/hexo-theme-yilia" target="_blank">Yilia</a> by Litten
      	</div>
    </div>
  </div>
</footer>
    </div>
    
  <link rel="stylesheet" href="/fancybox/jquery.fancybox.css">


<script>
	var yiliaConfig = {
		fancybox: true,
		mathjax: true,
		animate: true,
		isHome: false,
		isPost: true,
		isArchive: false,
		isTag: false,
		isCategory: false,
		open_in_new: false
	}
</script>
<script src="/js/jquery-1.9.1.min.js"></script>
<script src="/js/main.js"></script>






<script type="text/x-mathjax-config">
MathJax.Hub.Config({
    tex2jax: {
        inlineMath: [ ['$','$'], ["\\(","\\)"]  ],
        processEscapes: true,
        skipTags: ['script', 'noscript', 'style', 'textarea', 'pre', 'code']
    }
});

MathJax.Hub.Queue(function() {
    var all = MathJax.Hub.getAllJax(), i;
    for(i=0; i < all.length; i += 1) {
        all[i].SourceElement().parentNode.className += ' has-jax';                 
    }       
});
</script>

<script type="text/javascript" src="http://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML">
</script>


  </div>
</body>
</html>